CVE-2026-87099

MEDIUM5.7

Published 2026-10-28 · Source security@acronis.com

Description

Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

CVSS vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

CWE-79

References

https://security-advisory.acronis.com/advisories/SEC-8835

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-81472
Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
2026-10-28 · score 4.2
CVE-2026-116855
Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.
2026-10-28 · score 5.4
CVE-2026-87880
Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 6.8
CVE-2026-87879
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 5.9
CVE-2026-87878
Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.
2026-10-28 · score 6.3